Tuesday, December 30, 2008

Reinstall grub from live CD

Yesterday I had to install win$ XP again on my machine (until now I was using wine, which is great, or win$ as a virtual machine inside vmware server, but sometimes that's not enough...). As usual, the installation breaks the boot loader, whether you have lilo or grub, and you have to reinstall it again in order to be able to boot your linux (or whatever OS that's not a windows).
This is not always as easy as it should be, or at least I always forget how to do it. So yesterday, what worked for me (twice) was:
1. boot from a Knoppix Live-CD (it's just the one I have always lying around, and Knoppix is great)
2. Don't need a graphical session, just type Ctrl+Alt+F1 and go to the terminal: you're already as root
3. mount the file system you have your /boot files in, my case:
mount /media/hda2 (once mounted, check that this really contains or is your boot directory)
4. install grub:
grub-install --no-floppy --root-directory=/media/hda2 /dev/hda
where:
- I have to put --no-floppy, otherwise it fails (guess my floppy drive is not working, I never use it ;) )
- I always install grub on the Master Boot Record of the first drive: /dev/hda (if you have sata drives, then it should be /dev/sda
- root-directory has to point to the mount point from where you can see your boot directory, not to the boot directory itself (e.g. if you put /media/hda2/boot the grub install works, but you will have a new boot dir inside the previous one, and you won't find your usual menu.lst file).

Tuesday, December 9, 2008

Which application is using port xxx?

It can happen that you're playing with iptables, trying to configure your firewall, or for whatever reason you run nmap to see what ports are open like:

~$ nmap -sT localhost
Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2008-12-09 11:25 CET
Interesting ports on localhost (127.0.0.1):
Not shown: 1671 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
113/tcp open auth
538/tcp open gdomap
631/tcp open ipp
902/tcp open iss-realsecure-sensor
2628/tcp open dict
3306/tcp open mysql
18000/tcp open biimenu


And you wonder, 'hey, whats going on on port 18000? No idea what this biimenu is'. To find out the PID of the process using this port, you can run fuser like this:

fuser -n tcp 18000
18000/tcp: 4628

(Obviously, if it's an udp port, you have to put fuser -n udp port_number).
There you have it. Now just run ps aux (or whatever options you want) and you'll get the process:

~$ ps aux | grep 4628
user 4628 1.7 1.5 135956 56588 ? Dl 07:08 4:39 /usr/bin/amule
user 13899 0.0 0.0 3976 776 pts/7 S+ 11:38 0:00 grep 4628


Gotcha! It is my amule (changed the port configuration yesterday because of some problems with the kad protocol: It appeared as firewalled and I didn't really understand why, but that's a different point).

To put it in a script this could be helpful:
ps aux | grep `fuser -n tcp 18000 2>/dev/null`
user 4628 1.9 1.6 138864 58568 ? Rl 07:08 6:35 /usr/bin/amule
or:
ps aux | grep $(fuser -n tcp 18000 2>/dev/null)
user 4628 1.9 1.6 138864 58588 ? Sl 07:08 6:38 /usr/bin/amule